# ==============================================================================
# FaultyPacket — Cloudflare Free-Tier WAF Custom Rules for WordPress & WooCommerce
# Navigate to: Cloudflare Dashboard -> Security -> WAF -> Custom rules -> Create rule
# Designed so all 3 rules fit well within Cloudflare's Free 5-Rule quota and
# NEVER block legitimate WooCommerce Stripe, PayPal, or Apple Pay webhooks.
# ==============================================================================

--------------------------------------------------------------------------------
RULE 1 (ACTION: BLOCK) — Block XML-RPC, REST User Enumeration, Sensitive Backups & PHP2Shell RCE
Rule Name: FP-WP-01-Block-XMLRPC-UserEnum-PHP2Shell
--------------------------------------------------------------------------------
(http.request.uri.path eq "/xmlrpc.php") or
(http.request.uri.path contains "/wp-json/wp/v2/users" and not http.cookie contains "wordpress_logged_in_") or
(http.request.uri.query contains "author=" and not http.request.uri.path contains "/wp-admin") or
(http.request.uri.path contains "/wp-content/uploads/" and http.request.uri.path contains ".php") or
(http.request.uri.path in {"/wp-config.php.bak" "/wp-config.php.old" "/.env" "/wp-content/debug.log" "/readme.html" "/.user.ini"}) or
(http.request.uri.query contains "auto_prepend_file") or
(http.request.uri.query contains "allow_url_include") or
(http.request.uri.query contains "%ad") or
(http.cookie contains "PHP_SESSION_UPLOAD_PROGRESS")

--------------------------------------------------------------------------------
RULE 2 (ACTION: MANAGED CHALLENGE) — Protect /wp-login.php & /wp-admin From Botnets (Webhook-Safe)
Rule Name: FP-WP-02-Challenge-Login-Keep-WooCommerce-Webhooks-Open
--------------------------------------------------------------------------------
(
  (http.request.uri.path eq "/wp-login.php") or
  (http.request.uri.path contains "/wp-admin" and not http.request.uri.path eq "/wp-admin/admin-ajax.php" and not http.request.uri.path eq "/wp-admin/admin-post.php")
) and not (
  http.request.uri.query contains "wc-api=" or
  http.request.uri.path contains "/wc-api/" or
  http.request.uri.path contains "/wp-json/wc/" or
  http.user_agent contains "Stripe" or
  http.user_agent contains "PayPal"
) and (
  cf.threat_score gt 10 or not cf.client.bot
)

--------------------------------------------------------------------------------
RULE 3 (ACTION: BLOCK) — Block Carding & Automated Enumeration Against WooCommerce Checkout API
Rule Name: FP-WP-03-WooCommerce-Store-API-Carding-Guard
--------------------------------------------------------------------------------
(http.request.uri.path contains "/wp-json/wc/store/checkout" or http.request.uri.query contains "wc-ajax=checkout") and
(cf.threat_score gt 25 or http.request.version in {"HTTP/1.0"})
